"Jay Strauss" <me@heyjay.com> writes:
> what I'm trying to do is impossible,
>
> http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#vhosts
>
> I'm using apache1 but I'm sure it applies
Hello Jay,
Comments below.
>> I'm googling all over, trying everything, and can't get this to
>> work. My server works both ssl/clear text (from before I started
>> messing with
> this).
>>
>> I want my server to respond to:
>> testwww.heyjay.com
>> www.heyjay.com
>> testssl.heyjay.com
>> ssl.heyjay.com
Each of the ssl servers are going to need their own IP address.
apache+mod_ssl just doesn't work any other way (well ok, different
ports work too). This is in the faq for apache+mod_ssl.
"Why is it not possible to use Name-Based Virtual Hosting to
identify different SSL virtual hosts?"
http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#vhosts2
>>
>> NameVirtualHost *
^^^^^^^^^^^^^^^^^^^^ You need more of these. Let's start with ip
addresses. I will use 10.0.0/8 addresses in this example. You will
need something like this:
DNS settings:
testwww.heyjay.com 10.0.0.1
www.heyjay.com 10.0.0.1
testssl.heyjay.com 10.0.0.1
ssl.heyjay.com 10.0.0.2
You can put the non-ssl servers all on the same ip, even one that
serves ssl traffic too. One ssl server per ip address though, or at
least put each of them on distinct weird non standard port. This
example puts each ssl server on a distinct ip address.
Get apache to listen on the right ip addresses and ports.
listen 10.0.0.1:80
listen 10.0.0.1:443
listen 10.0.0.2:443
Setup the NameVirtualHosts directives. These should match your listen
statements. Once you put ip/port combinations in NameVirtualHost
directives, you can't use wildcard NameVirtualHost directives (like
you have above), or wildcard VirtualHost directives.
NameVirtualHost 10.0.0.1:80
NameVirtualHost 10.0.0.1:443
NameVirtualHost 10.0.0.2:443
Now the VirtualHost sections:
>> <VirtualHost testwww.heyjay.com:80>
Change the line above to:
<VirtualHost 10.0.0.1:80>
>> ServerName testwww.heyjay.com
>> SSLEngine off
>> DocumentRoot /var/www/heyjay/testwww
>> </VirtualHost>
>>
>> <VirtualHost www.heyjay.com:80>
Change the line above to:
<VirtualHost 10.0.0.1:80>
>> ServerName www.heyjay.com
>> SSLEngine off
>> DocumentRoot /var/www/heyjay/www
>> </VirtualHost>
>>
>> <VirtualHost testssl:443>
Change the line above to:
<VirtualHost 10.0.0.1:443>
>> ServerName testssl.heyjay.com
>> DocumentRoot /var/www/heyjay/testssl
>> SSLEngine on
>> SSLCertificateFile server.crt
>> SSLCertificateKeyFile server.key
>> SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
>> </VirtualHost>
>>
>> <VirtualHost ssl.heyjay.com:443>
Change the line above to:
<VirtualHost 10.0.0.2:443>
>> ServerName ssl.heyjay.com
>> DocumentRoot /var/www/heyjay/ssl
>> SSLEngine on
>> SSLCertificateFile server.crt
>> SSLCertificateKeyFile server.key
>> SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
>> </VirtualHost>
Both your ssl vhost sections above refer to the same cert. Use one
certificate for each SSL server. This way you can give users the
option of telling their browsers to remember your cert and not bug the
user next time they load the page.
I like to strip the passphrase from my certs because I don't like to
enter a passphrase each time I restart the server, reboot or
otherwise. <disclamer>I am aware of the risks of doing this. You
should decide if you are ok with those risks before stripping the
passphrase from your certs. This setup works for me, make sure it
works for you.</disclamer>
#apache on freenode is a good irc channel for this sort of thing on a
real time basis.
Hope that helps. Good luck.
--
Ricardo Anguiano
http://www.codesourcery.com
_______________________________________________
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech